D-Link D-View XML External Entity Processing Information Disclosure Vulnerability

CVE-2023-44412

Summary

The vulnerability within D-Link D-View involves a significant flaw in the addDv7Probe function, where improper handling of XML External Entity (XXE) references allows an attacker to craft a malicious document. This crafted document specifies a URI that, when processed by the XML parser, can lead to unauthorized disclosure of sensitive information. The vulnerability does not require authentication, which increases the risk as attackers can exploit it to gather information within the context of the system.

References